<html>
<head>
<title>Pass a remote iframe's document body through the DOMParser function.</title>
<script type="text/javascript" src="/shared/scripts/testcase.js"></script>
<script type="text/javascript">
if (window.addEventListener) {
	window.addEventListener('load', f, false);
} else if (window.attachEvent) {
	window.attachEvent('onload', f);
} else {
	window.onload = f;
}

function f() {
	var tc = new TestCase();
	tc.input = 'var p = new DOMParser(); p.parseFromString(ifr...document.body); ';
	tc.description = 'Pass a remote iframe\'s document body through the DOMParser function.';
	tc.expected_result = "unsupported or undefined or exception occurred";
	
	var ifr_same = document.getElementById('same_ifr');
	var ifr_cross = document.getElementById('cross_ifr');
	var parser = null;
	try {
		parser = new DOMParser();
	} catch(e) {
		tc.output += 'DOMParser not supported: ' + e + '\n';
		tc.result = 'unsupported';
		tc.test_passed = 'true';
		tc.saveTest();
		return;
	}
	
	tc.output += 'SAME ORIGIN\n';
	try {
		var doc = parser.parseFromString(tc.readOriginBody(ifr_same), "text/xml");
		tc.output += doc + '\n';
	} catch(e) {
		tc.output += 'An exception occurred reading same origin: ' + e + '\n';
	}
	
	parser = new DOMParser();
	tc.output += 'CROSS ORIGIN\n';
	try {
		var cross_data = parser.parseFromString(tc.readOriginBody(ifr_cross), "text/xml");
		tc.output += cross_data + '\n';
		tc.test_passed = 'false';
		tc.result = 'cross domain document parsed.'; // The result of the test
		if (cross_data == undefined) {
			tc.result = 'undefined';
			tc.test_passed = 'true';
		}
	} catch(e) {
		tc.output += 'An exception occurred reading cross origin: ' + e + '\n';
		tc.result = 'exception occurred'
		tc.test_passed = 'true'; // Did the test pass? true or false
	}
	tc.saveTest(); // save the test results.
}
</script>
</head>
<body>
<iframe src="/allowed.html" id="same_ifr"></iframe>
<iframe src="http://victim.com/forbidden.html" id="cross_ifr"></iframe>
</body>
</html>